The three functions that were the heart and soul of the Sandbox are now in the WordPress core. These functions, sandbox_body_class(), sandbox_post_class(), and sandbox_comment_class(), can now be convinently found in your recent WordPress download, artfully renamed as body_class(), post_class(), and comment_class(), respectively. Mission accomplished.

Now you might believe that this does not render the Sandbox useless as there are no equal starting point themes for users and developers. You still need a blank slate. Fair enough. But the Sandbox does live on in ‘frameworks’ inspired by and based on the Sandbox, such as Thematic and Carrington (to name a couple).

I would also suggest that the prospect of a new default theme for WordPress in 2010 further diminishes the usefulness of yet another ’standard’ starting point theme. Instead, the new theoretical default theme should satisfy the need for a clean, accessible, and well organized ‘base’ theme for aspiring designers and seasoned developers.

Like it or not, Kubric was this base theme for years and years. Users didn’t know where else to turn for starting point in creating their own theme, and since Kubric just came with the software, that’s what it was. And after said years, the need for an updated theme that could be the default ‘blank slate’ theme grew. The Sandbox was successful simply because it filled that need. It would not have been as popular as it was if the default WordPress theme hadn’t been old.

Because the core functions once exclusive to the Sandbox can be found in the WordPress core and further enhanced in theme frameworks (see above), there is no need to update the Sandbox. Considering the possible new default theme, there may still be a need for a new blank slate theme, but it won’t be the Sandbox. Just as the Sandbox was a new answer to an old question, simply repackaging the Sandbox is just an old answer to an old question.

Everything in the Sandbox is GNU GPL. It’s there for you to use. If you want to create a new theme with it, there’s no need to ask. Go for it. Your project will not be the ‘new’ Sandbox, but it will be yours and (hopefully) it will be new. Innovate.

And so you are left with an old Sandbox theme that did what it did very well: clean files that easily resembled a recognizable XHTML structure, semantic markup enriched with Microformats standards, a lot of knowledgeable users within the community to share experiences, and its major organs transplanted to WordPress. The Sandbox is dead; long live the Sandbox.

In the Sandbox functions.php, the pagination variable in the sandbox_body_class() passed an unsanitized variable that could be exploited using XSS.

See line 128 in the file:

if ( ( ( $page = $wp_query->get('paged') ) || ( $page = $wp_query->get('page') ) ) && $page > 1 ) {

The variable $page is never validated before it is passed to the function and then to the page. By simply adding $page = intval($page); (thanks to Andy), we make sure what is passed is only a number (see the diff of the changes).

This has also been fixed for the Sandbox theme for WordPress.com accounts. Please note that there have been no reports the Sandbox theme being exploited, so we are glad that we were able to correct this weakness before it was announced.

Now get back to playing in your Sandbox.

Enter Kirk. Kirk is exactly the person who I want downloading my themes. After downloading and playing with one of my themes (blog.txt to be specific), Kirk e-mails me requesting some support for some specific but discreet task. I help. I’m happy to.

Kirk files tickets on my theme project pages for things that are broken or could be enhanced. Some I accept, some I don’t. He takes both well. I hear from him now and again. A happy user.

Here’s what separates Kirk from most users. Kirk e-mails me wanting to know how to disable the generator link. For security, he says. Regardless of whether or not I think this improves the security of his blog, I help. I describe the problem and set him off in the right direction.

For this, I make him a simple plugin he can upload based directly on what Peter Westwood documented on his blog. Easy as pie. Took me ten minutes. I slap it into a PHP file and send it along to Kirk knowing he’ll take it from there.

But what Kirk does is, instead of being satisfied after his problem was solved, he shares his experience and provides the solution for others.

Community. Here, here.

There was another significant change. For single posts that are actually attachments, WordPress looks for a template file in the theme directory that makes the abbreviated mime-type. For JPEG image (image/jpeg), WordPress will look for a template file named image.php in the current theme directory.

If that file isn’t present, it then looks for attachment.php and then falls back on single.php. So each theme includes a new file, image.php. The general attachment file remains and was modified accordingly.

For Sandboxers, the relevant changesets from version 1.5 to the just-released version 1.5.2 are 247, 248, 249, 250, 251, 252, and 253. So now go on and enjoy new themes.

Barthelme, blog.txt, plaintxtBlog, Simplr, and veryplaintxt have been upgraded across the board to version 4.5. New features include gravatar support, i.e., get_avatar(), and prettifying theme options menus with the new WordPress 2.5 design scheme.

Most of the revisions are under the hood, so users are unlikely to notice any cosmetic differences. The theme options menus now each use wp_nonce_field() and filter content much aggressively than before. So users should rest easy that they are using secure and stable themes. I mean, these themes are each almost two years old.

The Sandbox has also received an update, which is necessary since its inclusion with the core has been pushed back (again) to WordPress 2.6. So be it. Anyhow, the Sandbox now has some improvements to its semantic classes, including new classes for parent and child pages.

As always, I encourage everyone to have a look, give them a spin, and feel free to come back with any comments, suggestions. Enjoy.

This means if you using the Sandbox /trunk/ with WordPress 2.3.x and you svn up, well, you’re going to get some errors. Apologies.

There are also a number of new classes for the body: body.page-parent, body.page-child. My favorite new class, though, is the new .untagged class for posts without tags.

So far WordPress hasn’t provided a good way to search for untagged posts. Well, add

.untagged {
   color: #F00;
}

and you’ll figure out quickly which posts are untagged. Crude, but fun.

I’m quite excited about the use of get_avatar and much richer hCards for commentators. You’ll now see the appropriate use of a.url for commentators with links and img.photo with avatars.

I also looked at how to best use the new is_front_page() function. There has always been a body.home class, so now I had to differentiate .home and, well, something else.

So right now we have is_front_page() producing body.home and is_home() producing body.blog. As the front page will be the, er, home page, and the home page will be the page with blog posts.

So chew on that sentence and then figure it out.

So what’s new with the latest version? Mainly it now features several localizations, including Chinese, Japanese, Italian, and Norwegian. I’d like to add more languages, so I’m hoping there are some international users out there willing to help translate. Please.

For those of you interested in a precise change log, I’m happy that Google Code has stepped up and is offering a much better UI. Much better. So you can browse the repository online and check out exactly what is new.

Special thanks to Kjell Knudsen for providing the Norwegian translation and the sandbox.pot file. Nokao has been kind enough to provide the Italian translation.

Subversion users can get the latest version from the Sandbox repository:

svn checkout http://sandbox-theme.googlecode.com/svn/trunk/

Kjell was kind enough to provide an outline on how to help translate on the Sandbox project home, Sandbox in Your Language. When you have your .mo and .po files ready to submit, just open a ticket on the Sandbox project home and I’ll email you for the files.

And I’m excited to be opening up the Sandbox to a wider audience—the non-English speaking world. A much wider audience.

Issue 48 resolves the stripping of whitespace in sandbox_globalnav(), the list of pages that occurs in header.php. Thanks to Adam.

Issue 49 resolves a problem with the new wp_link_pages() function parsing incorrectly.

Issue 51 fixes an i18n problem with translation of the text “and tagged” in single.php and attachment.php. Thanks to Lloyd.

Enjoy your holidays.